Apple Intelligence Photo Forensics: Photo Cleanup

Uncover how Apple's new Apple Intelligence/AI tools are setting a new standard in photo editing and forensic analysis!

Background:

I was just playing around with Apple's Image Playground and Photo Cleanup. Curiosity got the best of me, and I ended up writing this blog post of my experimental stuff on Apple Intelligence Photo Forensics!

I clicked a photo with my iPhone while I was travelling to Bangkok (Refer to Fig 1 below). This is one of the famous spots/tourist attractions for food lovers in Bangkok :)

Fig 1 Photo captured with iPhone

---

Original Image analysis:

• Extended attributes analysis:

  • As this photo was captured on an iPhone and later on dropped to the macOS via Airdrop, we see a bunch of extended attributes (xattr) added to the file by macOS. Refer to A1.1 below

• The important extended attributes are:

com.apple.assetsd.importedByDisplayName:

00000000  43 61 6D 65 72 61                                |Camera|

00000006

com.apple.assetsd.creatorBundleID:

00000000  63 6F 6D 2E 61 70 70 6C 65 2E 63 61 6D 65 72 61  			   00000010                                         |com.apple.camera|

• Exif data analysis:

  • When the photo was captured, the location data was enabled hence it captured all those location details and stored it in the Exif data of the photo. Refer to A1.2 below

• The Exif data of interest to us are given below and they signify that the photo was clicked on an iPhone. I have not included that Location metadata as it may be turned on or off by the user's preference.

Host Computer                   : iPhone 16

Lens Make                       : Apple

Lens Model                      : iPhone 16 back dual wide camera 5.96mm f/1.6

Lens ID                         : iPhone 16 back dual wide camera 5.96mm f/1.6

Extended attributes and Exif data of the originally captured photo:

A1.1 - Original Photo extended attributes

A1.2 - Original Photo Exif data

---

Modifying the image using Clean up feature in Photos.app:

I open this photo with the extended attributes and Exif data with Photos.app because the Photo Cleanup feature is available only inside Photos.app application in iOS and macOS.

Photo Clean Up process in Photos.app:

This section provides details on the steps involved in Photo Cleanup

1. Open the Photos.app and import the photo and click on Edit at the top right

Fig 1.1 Photo preview using Photos.app

2. Select Clean Up

Fig 1.2 Editing photo with Photos.app

3. Once you click the Clean Up,

   1. If you have never visited the Clean Up module, you would need to click to download the Clean Up module which will just a few seconds as shown in the below image

Fig 1.3 Clean Up being downloaded in Photos.app

4. Select the parts of the photo you would like to cleanup by zooming in and out.

   1. The Clean Up module will automatically identify people from the photo and highlight them in pink which blinks. If you would like to remove it, just click on the pink blinking area.

   2. Click save. You can either override the same image or create a new file.

Fig 1.4 Cleaning up process of a Photo in Photos.app

5. After Clean Up the photo looks like this:

   
   

   

   Fig 1.5 Photo preview after Cleanup

   
   

So, once you Clean Up the photo, the metadata and extended attributes of the photo changes!

• Exif data analysis after using Clean Up:

• It removed your location metadata along with your make and model data from the Exif data. Check A2.1

• The Exif data of interest to us are given below and they signify that the photo

Credit                          : Apple Photos Clean Up

Digital Source Type             : http://cv.iptc.org/newscodes/digitalsourcetype/compositeWithTrainedAlgorithmicMedia

• These 2 are added to the Exif data after a photo is edited using Cleanup feature inside Photos.app.

• Extended attribute analysis after using Clean Up:

  
  

  • Photos.app is added to the com.apple.quarantine attribute replacing the sharingd as it was dropped via Airdrop.

  • All the other exteded attributes are just flushed out! Check A2.2 below

Exif data and Extended attribites after using Clean Up via Photos.app:

A2.1 - Image Exif data after using Cleanup

A2.2 - Image Extended Attributes after using Cleanup

---

Analyzing the Exif data after Clean Up:

Digital Source Type             : http://cv.iptc.org/newscodes/digitalsourcetype/compositeWithTrainedAlgorithmicMedia

Guess what happens when you open this URL!

Fig 1.6 Decoding Digital Source Type

When you open an image in Photos/Preview containing this Exif value, it is automatically parsed and shows you the tag "Modified with Clean Up" in Photos.app (both iOS and macOS) as shown in below Fig 2.1

Fig 2.1 Modified with Clean Up tag in Photos.app

When the same info is viewed using Preview.app as shows in Fig2.2, it shows a different output saying the below which is retreived and parsed from the "Digital Source Type" Exif data which was added after using Clean Up.

Provider: Apple Photos Clean Up

Digital Source Type: Edited using Generative AI

Fig 2.2 Checking Exif data using Preview.app

---

Manipulating Exif data for fun and deceiving!

We remove the 2 Exifdata values to check if the tag/banner is removed.

• First we modifyedit the Credit Exif value to "New"

This is the command used for this:

exiftool -Credit="New" /Users/malware/Downloads/2DF49D93-4ED4-45D5-B6E6-3051B34076B1_1_102_a.jpeg

Unsuccesful Result:

• Even after changing/modifying the "Credit" exif data it still showed that the photo was cleanup

• Let's edit/modify the "Digital Source Type" Exif value to "New"

This is the command used for this:

exiftool -DigitalSourceType="New" /Users/Downloads/2DF49D93-4ED4-45D5-B6E6-3051B34076B1_1_102_a.jpeg

Success and Final Result:

• Wohoo! So executing both the command and editing/modifying the Exif values for "Credit" and "Digital Source Type" to New or literally anything or nothing (just empty), it removed the AI banner/tag that earlier used to say this photo was created using Generative AI and Modified with Clean Up!

Fig 3.1 Checking Modified Exif data values in Photos.app 

When opened in Photos.app no "Modified with Clean Up" tag is seen!

Fig 3.2 Checking AI tag/banner in Photos.app 

---

Conclusion:

Apple does work in mysterious ways! Why?

• When a photo is edited using Cleanup, the cleanup metadata is stored in the Exif data of the image and not the extended attributes!

• This exif data can be modified to make it look like the image was not modified or generated using AI!

1. How to recognize if the Photo is not original and modified using Clean Up?

   
   

   There are 2 ways for this:

   
   

   1. Open photo in Photos.app and look out for the tag/banner associated with Clean Up by clicking on Info.

Provider: Apple Photos Clean Up

Digital Source Type: Edited using Generative AI

2. Check the Exif Data of the photo and look out for:

Credit                          : Apple Photos Clean Up

Digital Source Type             : http://cv.iptc.org/newscodes/digitalsourcetype/compositeWithTrainedAlgorithmicMedia

c. Check the extended attributes of the photos and look out for com.apple.quarantine which will say Photos as Cleanup is available within Photos.app

com.apple.quarantine:

00000000  30 30 38 32 3B 36 37 62 31 66 61 61 63 3B 50 68  |0082;67b1faac;|

00000010  6F 74 6F 73 3B                                   |Photos;|

00000015

2. How can you fool someone using just Exif data manipulation?

   
   

   1. Make them believe, deceive the users by editing the "Image modified by Cleanup" tag/banner!

   2. Edit Both the Exif data values

      1. Credit

      2. Digital Source Type